Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 12:01
Static task
static1
Behavioral task
behavioral1
Sample
Booking Declined.scr
Resource
win7v20210410
General
-
Target
Booking Declined.scr
-
Size
1.1MB
-
MD5
72014c837d630e0eb8b79d0995166d47
-
SHA1
57ea4b26a34c0779ae9767cc957452883475cadc
-
SHA256
2deb22be02f4464416048e124a39c1a8df4f29ba90d783d27bfcefa29ddce161
-
SHA512
c74de6fc4b35c52b25062ca5d82f93e93f5978eebacac89fc6e473d6c52141b0737fccbd7810820a5c31ad08ad7288b86f6784b7e9ced821bab13d4a2c8b4c69
Malware Config
Extracted
formbook
4.1
http://www.evolvekitchendesign.com/ffw/
unmutedgenerations.com
localmoversuae.com
centralrea.com
geyyfphzoe.com
silverpackfactory.com
techtronixx.com
shop-deinen-deal.com
buehne.cloud
inspirefreedomtoday.com
chapelcouture.com
easton-taiwan.com
quanaonudep.store
merzigomusic.com
wpzoomin.com
service-lkytrsahdfpedf.com
yeasuc.com
mydogtrainingservice.com
galeribisnisonline.com
cscremodeling.com
bom-zzxx.com
ensobet88.com
vegancto.com
digivisiol.com
advancetools.net
gzqyjd.com
xtgnsl.com
ftfortmyers.com
g-siqueira.com
ufdzbhrxk.icu
tiekotiin.com
youschrutedit.com
takahatadenkikouji.com
goodfastco.com
jtelitetraining.com
planet-hype.com
gigwindow.com
levelxpr.com
besttechmobcomm.info
funneldesigngenie.com
mylisting.cloud
alltwoyou.com
mortgagesandprotection.online
monthlydigest.info
senlangdq.com
postphenomenon.com
slymwhite.com
masonpreschool.com
wahooshop.com
meridiangummies.com
samsungpartsdept.com
saludbellezaybienestar.net
vickifoxproductions.com
shawandwesson.info
nutrepele.com
gorillatanks.com
praktijkinfinity.online
lanteredam.com
refinedmanagement.com
tiwapay.com
fruitsinbeers.com
charliekay.net
realironart.com
sonsofmari.com
kedingtonni.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/960-65-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/960-66-0x000000000041EB50-mapping.dmp formbook behavioral1/memory/2040-76-0x00000000000D0000-0x00000000000FE000-memory.dmp formbook -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Booking Declined.scrdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Booking Declined.scr Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Booking Declined.scr -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 664 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Booking Declined.scrdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Booking Declined.scr Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Booking Declined.scr -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Booking Declined.scrBooking Declined.screxplorer.exedescription pid process target process PID 792 set thread context of 960 792 Booking Declined.scr Booking Declined.scr PID 960 set thread context of 1204 960 Booking Declined.scr Explorer.EXE PID 2040 set thread context of 1204 2040 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
Booking Declined.screxplorer.exepid process 960 Booking Declined.scr 960 Booking Declined.scr 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe 2040 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Booking Declined.screxplorer.exepid process 960 Booking Declined.scr 960 Booking Declined.scr 960 Booking Declined.scr 2040 explorer.exe 2040 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Booking Declined.screxplorer.exedescription pid process Token: SeDebugPrivilege 960 Booking Declined.scr Token: SeDebugPrivilege 2040 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Booking Declined.scrExplorer.EXEexplorer.exedescription pid process target process PID 792 wrote to memory of 960 792 Booking Declined.scr Booking Declined.scr PID 792 wrote to memory of 960 792 Booking Declined.scr Booking Declined.scr PID 792 wrote to memory of 960 792 Booking Declined.scr Booking Declined.scr PID 792 wrote to memory of 960 792 Booking Declined.scr Booking Declined.scr PID 792 wrote to memory of 960 792 Booking Declined.scr Booking Declined.scr PID 792 wrote to memory of 960 792 Booking Declined.scr Booking Declined.scr PID 792 wrote to memory of 960 792 Booking Declined.scr Booking Declined.scr PID 1204 wrote to memory of 2040 1204 Explorer.EXE explorer.exe PID 1204 wrote to memory of 2040 1204 Explorer.EXE explorer.exe PID 1204 wrote to memory of 2040 1204 Explorer.EXE explorer.exe PID 1204 wrote to memory of 2040 1204 Explorer.EXE explorer.exe PID 2040 wrote to memory of 664 2040 explorer.exe cmd.exe PID 2040 wrote to memory of 664 2040 explorer.exe cmd.exe PID 2040 wrote to memory of 664 2040 explorer.exe cmd.exe PID 2040 wrote to memory of 664 2040 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr" /S2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Booking Declined.scr"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/664-74-0x0000000000000000-mapping.dmp
-
memory/792-59-0x0000000001250000-0x0000000001251000-memory.dmpFilesize
4KB
-
memory/792-61-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/792-62-0x0000000000490000-0x000000000049E000-memory.dmpFilesize
56KB
-
memory/792-63-0x00000000050B0000-0x000000000515C000-memory.dmpFilesize
688KB
-
memory/792-64-0x0000000005160000-0x00000000051C6000-memory.dmpFilesize
408KB
-
memory/960-68-0x0000000000AE0000-0x0000000000DE3000-memory.dmpFilesize
3.0MB
-
memory/960-69-0x0000000000140000-0x0000000000154000-memory.dmpFilesize
80KB
-
memory/960-66-0x000000000041EB50-mapping.dmp
-
memory/960-65-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1204-70-0x0000000005E80000-0x0000000005FAC000-memory.dmpFilesize
1.2MB
-
memory/1204-79-0x0000000004350000-0x00000000043FE000-memory.dmpFilesize
696KB
-
memory/2040-71-0x0000000000000000-mapping.dmp
-
memory/2040-72-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/2040-73-0x0000000074E51000-0x0000000074E53000-memory.dmpFilesize
8KB
-
memory/2040-76-0x00000000000D0000-0x00000000000FE000-memory.dmpFilesize
184KB
-
memory/2040-77-0x0000000000C00000-0x0000000000F03000-memory.dmpFilesize
3.0MB
-
memory/2040-75-0x0000000000F40000-0x00000000011C1000-memory.dmpFilesize
2.5MB
-
memory/2040-78-0x00000000025D0000-0x0000000002663000-memory.dmpFilesize
588KB